Straiker's 2026 AI Threat Report Details Agent Exfiltration and MCP Supply-Chain Risks

Summary

Straiker STAR Labs reports that 36% of successful coding-agent attacks achieved code execution and 91% of successful productivity-agent attacks caused silent exfiltration. Its 2026 study also identified vulnerabilities in 4,242 MCP servers.

Key points

The report draws on more than 1,700 documented successful exploits and continuous ecosystem analysis, with telemetry current through Q2 2026; its outcome percentages are not overall attack success rates.
Straiker says 36% of successful coding-agent attacks reached remote code execution, with attack paths including poisoned repository content, shell-init modification, and sandbox-parser weaknesses.
Silent data exfiltration accounted for 91% of successful productivity-agent attacks; the cited dataset contains 412 successful compromise chains. Browser-agent outcomes are reported separately.
Continuous analysis covered more than 17,651 MCP servers and 130,667 tools. Straiker identified 4,242 vulnerable servers and classified 28.6% of cataloged tools as high-risk based on their capabilities.
The report identifies poisoned retrieval sources, excessive tool permissions, and redirected internal data transfers as recurring risks for enterprise-built agents.
Recommended controls include task-scoped permissions, approval gates for irreversible actions, signed and pinned MCP artifacts, restricted egress, and runtime monitoring of agent context against actions.

Article Details

Publisher: Straiker
Report Period: Research conducted through 2025 and 2026; telemetry current as of Q2 2026.
Scope: Adversarial testing of coding, productivity, and first-party AI agents, alongside MCP and agent-extension supply-chain analysis.
Sample Size: 1,700+ documented successful exploits; 17,651+ MCP servers and 130,667 tools cataloged. Productivity-agent dataset: 412 successful compromise chains.
Key Statistics: 36% of successful coding-agent attacks reached remote code execution; this is not a rate across all attempted attacks.
91% of successful productivity-agent attacks ended in silent data exfiltration; browser-agent outcomes were measured separately.
4,242 monitored MCP servers carried at least one vulnerability; the report lists 680 critical and 1,231 high-severity findings.
28.6% of 130,667 cataloged MCP tools were classified as high-risk by capability alone, not necessarily malicious.
Roughly 5% of analyzed ClawHub skills were classified as overtly malicious or grey-area high-risk; the number analyzed was not disclosed.
Recommendations: Treat repository content, inbound documents, RAG sources, and MCP descriptions and outputs as untrusted; validate provenance and monitor ingestion for injection patterns.
Limit agent permissions to task requirements, enforce per-tool authorization, narrow connector scopes, and revoke unused permissions quarterly.
Require human approval for irreversible actions and cross-system data transfers; allowlist output destinations and monitor egress.
Sign and pin MCP artifacts, disable production auto-updates, sandbox local servers, and require authentication and Host-header validation for MCP connections.
Monitor agent context against actions at runtime; protect shell-init files and audit writes outside coding-agent workspace boundaries.